Consent and denials of consent to data sharing in health care

• Consent to data sharing
• Denial of consent to data sharing
• Instructions for setting the patient's consent and denials of consent to data sharing in health care
• Data sharing between social welfare services and health care

Data sharing between health care service providers requires the patient’s consent

Patient data is always available to the service provider to whose register it belongs. The use of data requires an ongoing customer or treatment relationship as well as right of access to the data in question.

• How is health care patient data shared in the wellbeing services counties?

When a service provider utilises the data in another register, this is referred to as data sharing. Information may be shared:

• between wellbeing services counties
• between public and private service providers
• between the health care and occupational health care registers of a wellbeing services county
• between wellbeing services counties and other public service providers.

Data can be shared if the patient has given consent to data sharing. The patient can give the consent to data sharing after confirming the receipt of the information about Kanta Services.

• The provision of information about Kanta Services

Changes in the consent to data sharing

Until 31 December 2023, the consent for data sharing has enabled the sharing of data stored in Kanta Services between services providers.

In the future, the consent may also be used to sharing data that is not in Kanta. In this case, for example, data recorded on paper may also between wellbeing services counties or between a public and private health care provider.

The patient must update the consent to data sharing they have previously given to enable the sharing of data other than via Kanta. The consent to data sharing can be updated in My Kanta and later also in health care.

The consent to data sharing enables the sharing of data other than those stored in Kanta once the necessary changes have been made to the information systems in health care.  

The consent to the sharing of patient data covers existing and future patient data. Once given, the consent to data sharing will remain valid until further notice. The client may, if they wish, withdraw their consent to data sharing.

Health care and social welfare sectors have their own sector-specific consent to data sharing.

In which situations is consent to patient data sharing not required?

In public health care in the region of Uusimaa, consent to data sharing is not required if the customer has received version 1.1 or 2.0 of the information about Kanta Services.

The sharing of patient data generated in outsourcing services between the service provider and the organiser does not constitute data sharing and so does not require the patient’s consent to data sharing.

Denials of consent in healthcare

The client may restrict the sharing of their data by refusing to consent to data sharing. Clients can refuse consent to data sharing

• between different health care service providers
• between different registers of the same health care service provider.

If a client does not wish their patient data to be shared within Uusimaa, data sharing can be restricted by setting up a denial of consent.

Data for which the patient has issued a denial of consent to data sharing will not be shared through Kanta Services between different service providers or patient registers. According to the Client Data Act, the denials of consent also apply to data disclosed in other ways. In some healthcare organisations, the denials of consent may have been applicable to data sharing via other Kanta even at an earlier date. If data is shared by other means than through Kanta, for example on paper, it must be checked whether the customer has set up denial of consent.

The client can issue a denial of consent to data sharing

• concerning all patient data
• for a specific service event
• for a specific public health care service provider, such as a wellbeing services county
  • for all registers
  • for public health care
  • for occupational health care
• for a private occupational healthcare register.

As of 2 January 2024, denials of consent can be placed on all patient data and in registers of private occupational health care. In health care, it is only possible to take these denials of consent into account once the necessary changes have been made to the service provider's information system.

In private health care, it is not possible to set up denials on all the registers of the service provider.

Instructions for setting the patient's consent and denials of consent to data sharing in health care

In health care, the client may also give their consent or issue a denial of consent to data sharing when visiting health care. In such cases, a health care professional will record the patient’s declaration of their intention in the health care provider’s own patient information system, where it will be stored under the Kanta Declaration of Intention Service.

Upon request, clients have the right to receive a printout of a summary of the denials of consent they have issued. If necessary, a copy of the client’s consent to data sharing can be printed out for the client. Paper forms are not signed and are not archived by the service provider.

Data sharing between social welfare services and health care

Data sharing between social welfare services and health care through Kanta requires consent as of 1 January 2026. Such data sharing will require separate consent to data sharing. Before this, the sharing of data between the two services requires the service user's local consent.  

We will provide more information on the new consents between services later on kanta.fi.